c7f2088057fa3122e999e80e06b593c9b2af56c821c4afe27d107afd3c23cba9

Analysis

max time kernel
119s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2024, 04:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c7f2088057fa3122e999e80e06b593c9b2af56c821c4afe27d107afd3c23cba9N.exe
Size

96KB
MD5

4986a58fb36a0525abdf86b9429db090
SHA1

f1540d277179b3817b840e546cb21cd38d1ce498
SHA256

c7f2088057fa3122e999e80e06b593c9b2af56c821c4afe27d107afd3c23cba9
SHA512

579c27cf56ef0d20e2b752222be7dcb5a7f3a733496c2ca32d30e27822a66f25526d142edf36ada6bb4471644e88b205448bd3384d6a8b91ed11c9a03edc4c4e
SSDEEP

768:W7BlpppARFbhknrzzA8JQ2AdJCzA8JQ2AdJsS17BlpppARFbhknrzzA8JQ2AdJCm:W7ZppApkFS17ZppApkFSv

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4686) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Executes dropped EXE 2 IoCs

pid	Process
4324	Zombie.exe
4676	_l.bat.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Zombie.exe	c7f2088057fa3122e999e80e06b593c9b2af56c821c4afe27d107afd3c23cba9N.exe
File opened for modification	C:\Windows\SysWOW64\Zombie.exe	c7f2088057fa3122e999e80e06b593c9b2af56c821c4afe27d107afd3c23cba9N.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\UIAutomationTypes.resources.dll.tmp	_l.bat.exe
File created	C:\Program Files\Microsoft Office\Office16\SLERROR.XML.tmp	_l.bat.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Retail-pl.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.contrast-white_scale-180.png.tmp	_l.bat.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\System.Windows.Forms.Design.resources.dll.tmp	_l.bat.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\Microsoft.VisualBasic.Forms.resources.dll.tmp	_l.bat.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\cmm\CIEXYZ.pf.tmp	_l.bat.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\ar.pak.tmp	_l.bat.exe
File created	C:\Program Files\Java\jdk-1.8\lib\sa-jdi.jar.tmp	_l.bat.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\wxpr.dll.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\TipRes.dll.tmp	Zombie.exe
File created	C:\Program Files\Common Files\System\Ole DB\sqlxmlx.dll.tmp	_l.bat.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\WindowsFormsIntegration.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\UIAutomationClient.resources.dll.tmp	_l.bat.exe
File created	C:\Program Files\Java\jre-1.8\lib\fonts\LucidaBrightDemiItalic.ttf.tmp	_l.bat.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessVL_KMS_Client-ppd.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Data.ConnectionUI.dll.tmp	_l.bat.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\msinfo32.exe.mui.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Diagnostics.EventLog.dll.tmp	_l.bat.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\WindowsBase.resources.dll.tmp	_l.bat.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\w2k_lsa_auth.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\mscss7wre_fr.dub.tmp	Zombie.exe
File created	C:\Program Files\dotnet\host\fxr\8.0.2\hostfxr.dll.tmp	_l.bat.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\System.Windows.Controls.Ribbon.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jre-1.8\lib\security\policy\unlimited\US_export_policy.jar.tmp	_l.bat.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-multibyte-l1-1-0.dll.tmp	_l.bat.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\mshwLatin.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Linq.Expressions.dll.tmp	_l.bat.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\PresentationCore.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\sspi_bridge.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.Compression.FileSystem.dll.tmp	_l.bat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-synch-l1-1-0.dll.tmp	_l.bat.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProXC2RVL_MAKC2R-pl.xrm-ms.tmp	_l.bat.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.contrast-black_scale-180.png.tmp	_l.bat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\ClientCapabilities.json.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\PresentationUI.resources.dll.tmp	_l.bat.exe
File created	C:\Program Files\Microsoft Office\root\Office16\FilterModule.dll.tmp	_l.bat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\legal\jdk\lcms.md.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_OEM_Perp-ppd.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\7-Zip\7-zip.chm.tmp	_l.bat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems32.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\System.Windows.Forms.Primitives.resources.dll.tmp	_l.bat.exe
File created	C:\Program Files\Java\jre-1.8\legal\javafx\gstreamer.md.tmp	_l.bat.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_Subscription-ul-oob.xrm-ms.tmp	_l.bat.exe
File created	C:\Program Files\Common Files\System\ado\msador28.tlb.tmp	_l.bat.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\clretwrc.dll.tmp	_l.bat.exe
File created	C:\Program Files\Java\jre-1.8\bin\msvcp140.dll.tmp	_l.bat.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest3-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.AccessControl.dll.tmp	_l.bat.exe
File created	C:\Program Files\Java\jdk-1.8\jre\README.txt.tmp	_l.bat.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Library\Analysis\ATPVBAEN.XLAM.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.Compression.Native.dll.tmp	_l.bat.exe
File created	C:\Program Files\Common Files\System\ado\msado20.tlb.tmp	_l.bat.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\libpng.md.tmp	_l.bat.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_OEM_Perp-ul-oob.xrm-ms.tmp	_l.bat.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipssrb.xml.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Text.Encodings.Web.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Intrinsics.dll.tmp	_l.bat.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Retail-ul-phn.xrm-ms.tmp	_l.bat.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\WordR_Grace-ppd.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\System.Web.Mvc.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000009\FA000000009.tmp	Zombie.exe
File created	C:\Program Files\Java\jre-1.8\legal\javafx\webkit.md.tmp	Zombie.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c7f2088057fa3122e999e80e06b593c9b2af56c821c4afe27d107afd3c23cba9N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Zombie.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	_l.bat.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3580 wrote to memory of 4324	3580	c7f2088057fa3122e999e80e06b593c9b2af56c821c4afe27d107afd3c23cba9N.exe	83
PID 3580 wrote to memory of 4324	3580	c7f2088057fa3122e999e80e06b593c9b2af56c821c4afe27d107afd3c23cba9N.exe	83
PID 3580 wrote to memory of 4324	3580	c7f2088057fa3122e999e80e06b593c9b2af56c821c4afe27d107afd3c23cba9N.exe	83
PID 3580 wrote to memory of 4676	3580	c7f2088057fa3122e999e80e06b593c9b2af56c821c4afe27d107afd3c23cba9N.exe	82
PID 3580 wrote to memory of 4676	3580	c7f2088057fa3122e999e80e06b593c9b2af56c821c4afe27d107afd3c23cba9N.exe	82
PID 3580 wrote to memory of 4676	3580	c7f2088057fa3122e999e80e06b593c9b2af56c821c4afe27d107afd3c23cba9N.exe	82

C:\Users\Admin\AppData\Local\Temp\c7f2088057fa3122e999e80e06b593c9b2af56c821c4afe27d107afd3c23cba9N.exe
"C:\Users\Admin\AppData\Local\Temp\c7f2088057fa3122e999e80e06b593c9b2af56c821c4afe27d107afd3c23cba9N.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3580
- C:\Users\Admin\AppData\Local\Temp\_l.bat.exe
  "_l.bat.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:4676
- C:\Windows\SysWOW64\Zombie.exe
  "C:\Windows\system32\Zombie.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:4324

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-4182098368-2521458979-3782681353-1000\desktop.ini.tmp

Filesize
50KB

MD5
f9e3f204d19339394aaacc6b352a64ed

SHA1
740e383b889084ce2df3309514a5d9cb05c066ab

SHA256
7049f564761210ec4143b77c3cef534da4588f7929e20f0281bf3dc5d6917d3d

SHA512
bfcb7741aa0db4553c3c25d2667cbd09bcd6b48a57279cc66df7787952b98ed544d19c64d3cf2f308c2a04b17912947ff96ac5b3dd6a8c5349c12f3d13eff521

Download Submit
C:\Program Files\7-Zip\7-zip.chm.tmp

Filesize
162KB

MD5
1bcf1c0a2305f753d042dfbed9146f55

SHA1
3bc0042dddfb5195bafe617139b853ae70b933d7

SHA256
bb3ae0a9d8e45b77571e8b47749b4605f76f889af51adc5215d4096bf18a3732

SHA512
0956c61cc0cd0d7da9be5433ed1af8bf013f03d88deaa5eb0b7e0944361c416785c543e0853b9d70faaa7937992933e58645c3f964179a59c15e8a48f18170b4

Download Submit
C:\Program Files\7-Zip\7z.dll.tmp

Filesize
616KB

MD5
bb37e7ea76b1855873061b4f0f330dbd

SHA1
d13c63cfc0d628035e187dd49e8a3ac4d5e324de

SHA256
57cf423b1f01552506a4787da478ad9f5f13acc15c731e3aeed13fb254bd04c9

SHA512
89ef8a803bf629fec5f61785b2351254b9be1ba9ff92d14115281073f06b89d489c36842c8f320a87ee3328bb5047d716ca3176c3ed7cb2e0b5baeb79fb98a98

Download Submit
C:\Program Files\7-Zip\7z.exe.tmp

Filesize
594KB

MD5
e73a7a2205ce1338a6d4ae60b77189d8

SHA1
606163705201b173f6196970d4cee49ddb628bab

SHA256
f1500d6d46832ef8e0b30069985b8a4ab2272d0355bc9fa7999da3666bcec5d5

SHA512
f98e8137725b7db3767a9a7c0e5db70514f16a0f8d6abe615ed0ab438c940cfdca16a41699aaf1e1f42e6c2a3af96cfcb1c0de94e65ca54bfd0aafddbcee6b77

Download Submit
C:\Program Files\7-Zip\7z.sfx.tmp

Filesize
259KB

MD5
d42dcc2d8a4a34e11e26c1b26d282112

SHA1
1ec99e72b651c46d81543156308a0ec2eff1e71d

SHA256
91817147d7702d4c782f245c707b719e9f89d81e4c730f69599b9fc3898c2df6

SHA512
199aaaa019863ac0c9ae0ffdc0b798497e93f801e009364f85feec87697d3b22c4cb7bd57e8e636238d06c5560357f4be8a2727b80042fe69d9498c9290602bd

Download Submit
C:\Program Files\7-Zip\7z.sfx.tmp

Filesize
259KB

MD5
1a60f3c23d204a205122ed9c30d3ecbb

SHA1
b8533b09a8cb903bb83818bff27870079b37dea3

SHA256
0d573749f42ac78dc179a90e2a3ecdb75c98c1caf59c341598ec82cd752628f0

SHA512
717d79c86f2c9442d8654ca843a3e855f693dd480552739e5c44152718ac4732ddbb2edc686d0346513879982de867c46e7c8f76b0ef1d1b42c86afe46b8a721

Download Submit
C:\Program Files\7-Zip\7zCon.sfx.tmp

Filesize
238KB

MD5
a0a9fb5b7a3d83b7b4ca027677d5568f

SHA1
4b074c1b1f7fb49f0ca7b8b9fd1782d60101d0b1

SHA256
a2b39b368cb30185672a478cd37115bd82ad9ac616beda469e965033ce9f6c5a

SHA512
07d8762d5edf30c44b27a9160676b9a191d1b0a036fcfc9e129e0743450a8ba6ed32373c6249b1c6197723d18340d2d8fcdf79f62add200ff9fcbc5b6dee780a

Download Submit
C:\Program Files\7-Zip\7zG.exe.tmp

Filesize
734KB

MD5
e1b6ae3301a4b7212384c012eafbf93f

SHA1
91c0252af1b624dd1c28d5ae591dc2c357515735

SHA256
0cc9336f426c77e859d1051ce73458ba05c9607f5d1429720acd6102babe798d

SHA512
bba7c570c8fceeadee149d3a4769bfffd5a13a3a8bbfe45f0e008abf73af45b857a3d8ca040763dc48dd1c2c5c8e19a8ba89aa1a8c894258af102e8607b324ab

Download Submit
C:\Program Files\7-Zip\Lang\af.txt.exe

Filesize
59KB

MD5
da82eb195d2dce74c625cebf20c6b4e4

SHA1
d4d406eb9cfab7ba7ef89b02bf1fe85ca7558bad

SHA256
72b26b60b5158fe4cdbbb2b0962f8845259453359a18cf12f759ad60a95ba458

SHA512
c5390a767bc34036ff08f3ab7744b3b562ae4d37cbb129953a532a7b8a2d268202fc6b4dc3b4f9322ea00d9acd8584c1cad5f69e0d22bbd32d500da074fdee0a

Download Submit
C:\Program Files\7-Zip\Lang\be.txt.tmp

Filesize
61KB

MD5
98cdc55a3b3d09a3593bafc9614ebce8

SHA1
f3ce50705d3b74ba4fbba854514588640eaa1079

SHA256
42100592379a35368cc5062effed9ed2a31d59dddd55cedc0a50f19a805b6236

SHA512
93f1e752e8d5af7440000d5f5a864fe8ca5c3130ce81176fc7d7a009f322c781c0cdacb70ec1ea32edc5bef22af6cf61904a41c3b5f574069a7fb14832dc2799

Download Submit
C:\Program Files\7-Zip\Lang\bg.txt.tmp

Filesize
62KB

MD5
aabf8622eb9ffc213809f00f6ff7c08d

SHA1
7fcea20e799de058f4001331ba306bbe2955a0ad

SHA256
e22288d94a8ef82643883cffc13c7b25178c537001490a23fe3ce895e01c67b2

SHA512
b58fa35ac5f1e75c103eee16cad64d6535ca0e0c5b1c7b1ffeeb8945c7978a89d6c3c7c881fcbe551905d893712536b3444607d93dd3df593f56d216ccacf28c

Download Submit
C:\Program Files\7-Zip\Lang\bn.txt.tmp

Filesize
61KB

MD5
8e05716c82f14bf5d24c016fba485837

SHA1
2dd40515b89ab54a901d13381c9fcc2b950c2808

SHA256
b214b77ad761234c0f7451ed70365d9357e7512280025ec79ebaabf7d5ce1ef1

SHA512
8fc6fb83f6a34bf375e4b6b19ffff1641cd53a178d284b1edb5ceed6d78d34e5752fb8a7a39516510639a8ff8aad85ce53531b965dea4dd7adf0a7675d048064

Download Submit
C:\Program Files\7-Zip\Lang\br.txt.tmp

Filesize
55KB

MD5
daacbedafee426d56f2960dd7fbd7388

SHA1
f2d6a19807aa8ab6befd7de57af8a3847f338e5b

SHA256
b46b998f88fd1c28eef81a1b449b6f64934e0e92b4bbafcf63ef784de1a5c3c5

SHA512
f7238cc7a35d5d45e5415f710c2a6ad604e4ef72abf9bb5f8cbde94d5387433c013f160bde5c02d16b4cf094bb1e66d820a4a2b39da120354c8631b7b7000029

Download Submit
C:\Program Files\7-Zip\Lang\ca.txt.tmp

Filesize
50KB

MD5
e37e86aae50a4a4e6f158d649eef3be5

SHA1
6aa4d852ffaf165bc7afeb995fde1b03d4afa137

SHA256
c90cc3ad793596b066b55622c4597d7092dd6820b2ea65a2a5e493edddf5ce9a

SHA512
608f270e855a89b9f859e98aeabe9d91c4406442ffdc6c8035824627e7ef48731cfbd15d9b8e0ebfdc6becf6b9d53509aaa5e79e962b5421003b7f71d528d1c2

Download Submit
C:\Program Files\7-Zip\Lang\cs.txt.tmp

Filesize
55KB

MD5
13fc0fd15083357f60876508524fa95f

SHA1
e6f8513d8a809f117c60983ad778f78349c905da

SHA256
eada69ca6b72021b808a558560cb152ed0a66afa5de9954b1ef10f8f51e2a87e

SHA512
af40b2051170cc155449f93f6b88a85ddf7d29708edba65f1b12fe2d9bc3bf0c25e0d6ab6015a25c636229a6846fa6150b4d01aa2e675f1ca89acad9a4bf33fa

Download Submit
C:\Program Files\7-Zip\Lang\cy.txt.tmp

Filesize
51KB

MD5
3814ce407015d1b14b1724be9b01641b

SHA1
0d13c4979c2380a69dd9b7eee009aa81cedf5afe

SHA256
ed2084a9cba33d3a5ba835680e0b4d3029cf57edae36f062c2720fe2016c7993

SHA512
4bc6e800f629154623c347b93732d3d28a8e56af5d1d26bda307c7bf048d5163a51d14bbb04f7ec5b2198209641a73e62b028f20869764943a58faa37b0643b7

Download Submit
C:\Program Files\7-Zip\Lang\da.txt.tmp

Filesize
54KB

MD5
c0c14b0206c4364bdb3f42b6f76c8d8b

SHA1
33e173cb5b98d5326b75b872a18494c1005b345c

SHA256
7e02785fe714133be717c375848e58f477b6af8b053cb20a2ddabcc09e3edc3a

SHA512
7cf21d97d453d7e4cafcdad599142ce50a1eca46204b935fbe568b7e63edf1a6002d4e1db9e5c0720e0e9ce956e3902f4d8485e3bc5ad66410a6223a83a53d3f

Download Submit
C:\Program Files\7-Zip\Lang\de.txt.tmp

Filesize
56KB

MD5
b1de46d72effd846da12d78243cba19b

SHA1
0900fa1210adca1fa0a9b8a3195c29a3ed2a8c70

SHA256
ffa166afafcbe2bd062af17a744b4117afe44dacd6625e1e0ea3ddda9717e6b3

SHA512
4f319e35de075700fc53c3e19bf5485ea1f9d371e4a81bbc18cfdc1db5ff729aa5e0158cc3a08d5f53e4367a61d0c7334149fc1d0c737eb5ef9dc0d68300d55b

Download Submit
C:\Program Files\7-Zip\Lang\eu.txt.tmp

Filesize
58KB

MD5
6de1b27f9906e2cb1706bc7ef688efb4

SHA1
12189b233f3ab3585f07376eac125381b514108a

SHA256
b79cedffa0a37af302a065ab9184e87df96adb25193d2181d1dbc0abd13ac3cf

SHA512
65c7adb67ac8209d201741126da64d7a061fd10aea2fed72a91bc2dc46eaff40c20a4b1f755ddba6628ede90658c97672cee298c223f556caacf4484ab24a1e1

Download Submit
C:\Program Files\7-Zip\Lang\ext.txt.tmp

Filesize
54KB

MD5
4ac77f8998149a9d8eb151c72e458f05

SHA1
63b9650554a01bd8a5d0eb0217eb31d3160e20b3

SHA256
c99387f9404cc567059a92c4ecb915e84b6cfed0a89bb9701b2e6ecaa84a5873

SHA512
5c9b05a27fbdba3ceafc8210f34ba68495df14dd9d90613e4770845807964bcf4e9d171ca339c55a9a3782bac730b12afed5fc93b4cf099af95ac370aad8d645

Download Submit
C:\Program Files\7-Zip\Lang\fa.txt.tmp

Filesize
60KB

MD5
4aa8ce8feed7c4402485531a14c59d93

SHA1
a6c1a7bf97fd0b0fa44e781ba710628ffdda05b6

SHA256
ea2b72accfd223806ad1186e31fdd966103802e4fc8bbc6e6b82ab7147568940

SHA512
56d7297bf7b67da3afc7d8a9b3a4377693731ca197c7f30df8241339843cd061570b164b49bd76cf8571546f9ae936d65402a577d43b0deb33fea832ff70b0a9

Download Submit
C:\Program Files\7-Zip\Lang\fi.txt.tmp

Filesize
58KB

MD5
bb08ad23a52f113dea2785de84651f92

SHA1
b41c6a376028899501e3e5eecb3bcee2531d1340

SHA256
cb1495b14a2684c3a056ff8dcd32a1e2e8e2ded531ce1b6bc82b0fd5d51c9add

SHA512
e945edc67e7e6b8989897ac1b16ea07136814c217e64b171bb142ce4f52bfd4d31dc6d0852d2e6c37d1e5450cbf59378f3c1e3e502ffe7e0b093896d36b03d81

Download Submit
C:\Program Files\7-Zip\Lang\fy.txt.tmp

Filesize
52KB

MD5
55fa48de2268003c1bd859866c8fcc70

SHA1
3848d058f267f5e2d2f47deb2a60b90c79283082

SHA256
eafe63bb8f3a64541afe15b8699a6f4b9cf30fdf228261ba8822d9ffac4c90e7

SHA512
94c031d041c85ba21f1977c1d6791c7279e59ec8e7659a57556918d50f8b265b409c6886f84f9f09b78d01b7ea8b77ae98f38813f05de4975902bb8169d91770

Download Submit
C:\Program Files\7-Zip\Lang\ga.txt.tmp

Filesize
58KB

MD5
f0fc705664b8b7a242118c4f46e1a3c6

SHA1
b8d4061bc9ffdf013407112a921af0c8aeefef18

SHA256
7e78f14c37a41dfe699d080b5ce2cee09a58a8f010851e9d55aa54f7a23a0368

SHA512
3a36ac9e399588aae46e091ba0d70b08fa48de00d949a918cc0f22cc12f709ce7a6addcbd409761f87c5b120f8b96ea21870c9d7143a48444d40ca8e5ac1fe81

Download Submit
C:\Program Files\7-Zip\Lang\gl.txt.tmp

Filesize
59KB

MD5
870e6884972ce7de1c04a7c9db718d0e

SHA1
53e32946a76bad56e2829fa1f4a5b05854295c8c

SHA256
c160c3f890252ac4e5753ae42721520ed95e34a2589fb003e0a7aa7f0cc6854f

SHA512
127f631e4c24be45e8fff5b02970d61e574c8af38f8b785259b82db93d993759dda70b960937f54c4ff89d2d81a82348553335de070b1af44e6bb542deb174d2

Download Submit
C:\Program Files\7-Zip\Lang\gu.txt.tmp

Filesize
67KB

MD5
8f2845d77b99c5a721e39218084116b2

SHA1
17676bee36bcb33ea43c9c94188113ce12c6ab8b

SHA256
104782b80c0d0b958952347f076799435680e05cc848022207fcc4fa54cbb7ac

SHA512
235e06e02168a26cc1425a41249d5c4cb35cdc70342f092843bfc71c934e30d51c03eb744278e16e47d7841fe1c619d64e0ae243dcefe7dc151b2cde1dca7950

Download Submit
C:\Program Files\7-Zip\Lang\hr.txt.tmp

Filesize
58KB

MD5
a3446bdfe7a0cd92921e672bbb2e8a25

SHA1
0adb3dfa42407d7b0b397994a93768de48c61f6c

SHA256
00640a9747a6c24428e52c9c72031c946d288c58f03be909164c8de012c27957

SHA512
df4f0fbd3392422a6bae7ad6b05ed310d0bb59ea2f35de8913907af864cc5153e27f8f8369c3699d4bd52fdd08d771f09e477fc3e71d7f869f6332d2041731fe

Download Submit
C:\Program Files\7-Zip\Lang\hu.txt.tmp

Filesize
60KB

MD5
c9bf9a332f56e8bee623b21865d812ec

SHA1
5b34fbf79d844ea5a057f095e6ab0df7eb40ed22

SHA256
81dac4132bdd5ea9aa33a245adcbef72374ee0e9f725ed623a1fc68365240c20

SHA512
2d5ca44cdcea154d8da06dbf0d47e4bc5cb24078ae20c399e8189fb2137ff03b6776f9129cdc1491c9249621270c2f986d442b100e9c78c16e1596e9960893ea

Download Submit
C:\Program Files\7-Zip\Lang\hy.txt.tmp

Filesize
63KB

MD5
8cfb9d1757319782a6e78dbdfe691360

SHA1
dfcf9135e47ae8256fdfeef065f10856de126b25

SHA256
1f3637c3fa6496e35e186170331800fbaf49dc2535f8ddb4c5590d6ff7a5fe9a

SHA512
195f4297ba7a2bf80ee863a21ce832e70dd44725f26a5ff458553c21cbac75bc648d37f6ca62c2b579911cb14831bae2b4534ec333b9bfbc4fe76eab99b68a1e

Download Submit
C:\Program Files\7-Zip\Lang\io.txt.tmp

Filesize
59KB

MD5
117e0ed55e8191437952ced973a08ab8

SHA1
0788fb0b3756abf1dcc9a9fe08460ede12d24808

SHA256
3ce7132478a3714844b161b957a8e59c653e2a1edee5a863262d606ef7bec9c4

SHA512
067574628dcd70e10715c77436b5d6d1cba5f0480ef459d5303d8ef3e97f3ace0569c273b35ae3754ade75184e7f4828d269646987408b4e3c6623b8ad295e06

Download Submit
C:\Program Files\7-Zip\Lang\ka.txt.tmp

Filesize
67KB

MD5
6995159fa274e58c3d48a704740b8f01

SHA1
679d1afa74eb03a312ba22e755d34906158bb438

SHA256
f1d3ed6a4bd5a8132c8d9cc086bc2788d19a2436434b327c309ed7fa8fb1153f

SHA512
3cb5fe23212227a5e5f989ae9edd26ee5da0626e095879af751e13112ca728287c04104384a9f565c151746fcc4924d4388152c69c0c1fa0af3826fdaf5089ae

Download Submit
C:\Program Files\7-Zip\Lang\kk.txt.tmp

Filesize
60KB

MD5
56633f521e15736b6307a6d7e0f70a5e

SHA1
5e48db5dc0006a822c073f4ec63215ebd21edefb

SHA256
7e644f1f4c88cf4ab5d923dd797660f6999c529cc689096670e0871531aa5b21

SHA512
c866a2e18a024ef482e933b6e4360ee2299e2595581d5d075dc9a86d41d518d5b915a20c422d87157d0b0f0f2a1914840801983462acfd4664dc9e9ee99c19cb

Download Submit
C:\Program Files\7-Zip\Lang\ko.txt.tmp

Filesize
56KB

MD5
00455e2b194aa3c0eb3c2fdf9dfa5eec

SHA1
7d6e137d5f5fefe017e45c7ecca691a90b887f34

SHA256
d565a60397de4170fa8b1c703b70bdf694ef167abfef3c04e1a10595e6b5b818

SHA512
03ce4f7fbc590ff8afd983e64573cf938d14a3d8526bc64e2dfd1d4b50a03149c27f61f9fb44cde03c7e1a57fe70a8a29aedb2d2759041669aec515986b5597c

Download Submit
C:\Program Files\7-Zip\Lang\ku-ckb.txt.tmp

Filesize
58KB

MD5
57cd37581ba2ad015d08ffbf6aecd8f7

SHA1
699d429cc4f37eb56c8e4c13dd157c12c02c3072

SHA256
0fd694761455285fe59153daa4b6befd16f85980ba2d7fff0ba2dd8276df0078

SHA512
1415c84cdb4cb1f9ed7a987e49ee16468e622eb21bdc89e7e408692b3a61419c8c94e12c0a8c5df6c7cb0b42a0493532449ffd886da944965e0f7cfa91d4f274

Download Submit
C:\Program Files\7-Zip\Lang\ku.txt.tmp

Filesize
52KB

MD5
6f02d52204121a76b53e71bc1ef849c0

SHA1
cfd403bd46bb0af5469504c623e51f90c3eb7612

SHA256
e33124221cc87952d5cf7a99fd9aec703157aea6e06d68cdc243daabd292799a

SHA512
3a05bc35ad85a5f5a7ec05efe61859b420f6e0d201d50d71e8691e49de93187979e3e506a2cfce7d749dedfddebe89aa9228f19f2d835dc525d906a111f54eec

Download Submit
C:\Program Files\7-Zip\Lang\ky.txt.tmp

Filesize
62KB

MD5
c2e1e160217a7bccd58b33d131ca74ad

SHA1
2d43933bb98361f4bcde01749a96e702ee515cfb

SHA256
c7bb62bdaf5e9fbab48614c61bccbbb459da1f04e61bc5eb98593700bc13204b

SHA512
6068377e74423ed17a324d910fafdcd3b910f78010490e3eea5d79029a882c87efe6b9a563ba6cf337a4005ac3197fd89b9523b04488f061f4b0d62820c6f4ad

Download Submit
C:\Program Files\7-Zip\Lang\lij.txt.tmp

Filesize
54KB

MD5
d45cb9b00942b8f3b50d4174b179937e

SHA1
8aebd189b7f0792c1b249ddddeee3de43c0ad1b1

SHA256
0cede625b9555f8937365d1461d4f5204cbba625c58edec9acf82a7c68801026

SHA512
be8890b35bc8d90702fed94723b692155c587f670a8eefcc7b4abd25b8b659319256f6bf47f0e04153298d3dd6c65238f45b43e310f0f80e329fd46a55efc836

Download Submit
C:\Program Files\7-Zip\Lang\mk.txt.tmp

Filesize
58KB

MD5
7b93a68f9f845adc1f3ada3983ae5843

SHA1
c9b2681b92def24b243d9ceb6a91d41be4a62ea0

SHA256
4f6d904c26766f652bde2922d3df0139afcfc76d869b531e1068dcca1f3add98

SHA512
1b9f37e22daa0c3bc41b5c82c10dadbca8b5dedd2f5a6ae84c65232613d85934ab4b5cf73adc1fdcdc96efdc7ffe4262da42f091c8157d308790d9da5e79521f

Download Submit
C:\Program Files\7-Zip\Lang\mn.txt.tmp

Filesize
58KB

MD5
731bb23fc99a05125b82a4ea3dd627ea

SHA1
f2075cf31d85d0e134a6a08dbc721043bd4539bf

SHA256
baf363d424b1c56436164736134e642ea004b3da8a7a91210b45c80f4d22ec3e

SHA512
bf033c5e83d11ba73c50c9299094dbad9cce3dfda6ac0c20b7240e85cb80d5d0650b86f3a47c46cc44eb07b1a3854b228e1395c4574745692054833c735f8450

Download Submit
C:\Program Files\7-Zip\Lang\mng.txt.tmp

Filesize
69KB

MD5
a47765ac2ac10400121884130b36c7d9

SHA1
6bfbaee79832bf6c6bfb4d57fcb037d131418f97

SHA256
9c210317be4fff717c77096339e8869265afb8dabc28821e9f9210f3c5bbcca4

SHA512
0d527b6996ffac63b83c29b30f7ec3e84eb5c05ea0c20d25ae0f2786e95b011f49c626c7c627a0d42b40c3f011839cec40a126c872f5dbe9a133a836c35b99cf

Download Submit
C:\Program Files\7-Zip\Lang\mr.txt.tmp

Filesize
60KB

MD5
70f223ca8dadd4c38b53c17718d0d5d4

SHA1
65cfae303f7cf1872602fa24223f935c90368d51

SHA256
59941a0f71eb38605f7fea87df68ce406cf61bc074263b527291fff614bfefa9

SHA512
a87859a9cc5d4e6b0b9141864ce603ee2cabed8305161d0f74faece6463adbf4714d0ad3bffdeb06e1e373bf95ad6ad8e916a6dcc47d97160aeb88986f11fee7

Download Submit
C:\Program Files\7-Zip\Lang\nb.txt.tmp

Filesize
52KB

MD5
dc91aabc128cc321f7a7da57c0ede12b

SHA1
2f0171421a084e30b3483ee000bb29f4694a025f

SHA256
4604d00c9301ee25533eca75b719349f2cee572aa9e572b918a1af7fa2d7a73b

SHA512
e720da1e72af5f908c35297667fdb49790f590eeb2a62fa3a9115bccb97a194a96df268f87738aaee06b1de83b18b413a3093723d592cf6b12e9dde9efb663c9

Download Submit
C:\Program Files\7-Zip\Lang\ne.txt.tmp

Filesize
63KB

MD5
0e9b102e45d1ef3a74f7ce04cf30fd43

SHA1
042cf6aa30322d9b4920322cb4b0d7e0a7e1a207

SHA256
717e03dbe25c583e979f075b5cbf3dbb313e0941482dc988fdd44acdc57f356e

SHA512
c061f397387378f0f64b7d84bb4c369b52ef55bdb6b61904a47eb21a2febe182b8f7f49c93b131df6c33db9f65e87461a69ee30755bd3c2ad450deeed7e00e90

Download Submit
C:\Program Files\7-Zip\Lang\ps.txt.tmp

Filesize
58KB

MD5
fddb577352e99f753dfb60e5b9049a29

SHA1
10f702db9c3d2c75fe9fd0da25aa9e2e5a4ef6f3

SHA256
409686a7c2845c1250e7fab97918c8dc8fbc5df048db8e437f06ba2f5373f093

SHA512
bfa01268e2752199055808b08e980d937bf13ab9907e581c2876e7935c784207a5f21dab2a805331031b0e5ef7ded9f21de3ba1ace1f5a17a501db801841d6ed

Download Submit
C:\Program Files\7-Zip\Lang\ro.txt.tmp

Filesize
54KB

MD5
21ca1d8aa59c59c60abd2941d4f4710d

SHA1
d05bddd6d9b0dd37bba4d39d7e6bc6f0afe472ac

SHA256
a51a175f288245dd444f55691139ba652a39017cfe1e8bcaefbea81c4d46537c

SHA512
9ddf3c6404fc7e3b8f02cb70abae08be23f22a772a29d4d4a21cf2830114c1cbf9078bf0cca993f3f3736fbe0be22ab97a65182e5e8b9a721bf2a3b9c866a4e1

Download Submit
C:\Program Files\7-Zip\Lang\si.txt.tmp

Filesize
46KB

MD5
aa3e7fbadf352f51cb7bb268b65b9fae

SHA1
a20dcbfbe197cc2c3a7766dd4fa96f5ed4a920b7

SHA256
8e2e7efb7f3b0f58b9a12abd4519684a643ef56c455ad1bbba1b91c0dc3900c7

SHA512
ce30e77345cf1c6f17450bcff4b75df533a768c38a9ff5424d22bcbf828983fdca220bd180edc642942edb99b4088320e8c83f5d931ebdbdd01c7860d0ff645b

Download Submit
C:\Program Files\7-Zip\Lang\sk.txt.tmp

Filesize
59KB

MD5
4e348947e6347cbe68d5e6839e7d0b30

SHA1
e76eac964132a49723fd993eeaf6f778ba12ec2a

SHA256
802d64294eee9f5a4035b5c92c3bb246cfd91a64e822898f1192b96afc78eb0f

SHA512
58dc011d1709b73aa92123a641afe42727c247544dceb2cb77517f313050e227f6882c3a3a14153498713ffd7efbf7a33b9af686f3e398be2c167aaf5f82f207

Download Submit
C:\Program Files\7-Zip\Lang\sq.txt.tmp

Filesize
55KB

MD5
dd733e4eecd76967b8887dd7c38b9dd4

SHA1
8ff8add48f39aea0e1f5f9a360e6e3815983e517

SHA256
2ac2376dc45716505dc289b4836718a922ad39f872292bd22ab709c6e891660c

SHA512
7f5bc2e76b4728aa2a6973e23dc889e79354513a15306da70859ce7bdd8433ffe7a4d39d1ef7634466cb80de3beea3c20888141dbf489b14f0cbe434cc23f499

Download Submit
C:\Program Files\7-Zip\Lang\sv.txt.tmp

Filesize
59KB

MD5
6a1808f360679f0482d51b3406e7633f

SHA1
cfce22b4783d5feb502f13e9f05b455a0554db20

SHA256
ab2e4924f24d7311d17a9051ef4c63b1e533e5ef99d42fab814f67786b066774

SHA512
c8c8574d0cd8175af4db84ab74f714fc22a4abd8689a5de27da4f18907ce52728a253ef6df650d3fe910ae4c31b66e71f6f494c782ec35d9dd10e9a997158b42

Download Submit
C:\Program Files\7-Zip\Lang\tr.txt.tmp

Filesize
59KB

MD5
5dbd15dd14b9448ca52e93eedb05e9a7

SHA1
0a5b1b0cf2228ac7d2eb6a7581e2148516dfa23f

SHA256
d952933028fd430a37a65daad8118ceb6aedab2e84eaf089df5b4854137308ab

SHA512
940018e8a35410842ffe9c2e1dcc59623672ade1ed341f35244031696ee8610fcda250d0e48a228f53826fd43854cfad3810eb77dccc70d3e416621de7901205

Download Submit
C:\Program Files\7-Zip\Lang\uk.txt.tmp

Filesize
62KB

MD5
9a8de806c0c27a7af6c91bdd69c58235

SHA1
ccd1cb1db82c12c7ff355cc819c53531aa78310e

SHA256
871a51370ad07bbe9507bede947f1d8000afc9fe84bfa7d554aec8067eb90dae

SHA512
2d5703a11ea816d22f08c7ef133a502a8752cdfee76a27c524a614ec9f0f345bf79e3b4617e8446d895ebed7e936862b443b405dd01f35429c512dde95a3eb32

Download Submit
C:\Program Files\7-Zip\Lang\yo.txt.tmp

Filesize
56KB

MD5
4d5c3840a6f6a9d15214956b000ee1ed

SHA1
032cfc2bd02636f30c1dbf44f957280f20fc8f23

SHA256
f4b8a3eeb1aef0f0366d50c6522818340b428fd456254a23cf75e9e2bfbeb13b

SHA512
1ab347fcf42a3f971ce3362c6a05d33f3f9564b6b8d11b993cf3fedc4529f7518d3480a92bd1b8c7136210f7171c498f20b2d5c10745f964b8a6d8b399fc14ea

Download Submit
C:\Program Files\7-Zip\Lang\yo.txt.tmp

Filesize
60KB

MD5
5f6108985362e525388554001f27bc73

SHA1
90a8fc008166bf9bfa3ba9a0839094b8b7369b99

SHA256
a9909a5774ce94682a8bf44326159dd363b214288fd56f404e83bec3025ad7c5

SHA512
ff6b1cfedd3e6d0df1d0d32cb9b4f8d521f4f3648a5ef55d69e373a6017696f506416e871394d39835d5345cd326dacd4a639b9461503acc23e56493fe702996

Download Submit
C:\Program Files\7-Zip\Lang\zh-cn.txt.tmp

Filesize
58KB

MD5
e6af9d079d19465d30d7d0c4fa6358b8

SHA1
25edbed6d413eef416c7080736836c581917ee9b

SHA256
38f506c08fb66395c360daf9c1116b44239d9dd4a062d23ad58762c4fc08381c

SHA512
be59e3919cb2fa3fbf76a19e8dd116bffcd60cd9208fea7ab4b330354abfdc518f638910646d3744ee783770b91e8e504d3dcf528ba93a20ff7cd50afdbcaf3c

Download Submit
C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Retail-pl.xrm-ms.tmp

Filesize
60KB

MD5
867778eb1de92b18514fd49ce8e04656

SHA1
d6667888e3248870f1407d04c1002b3e689901fb

SHA256
3be3eda066ed8a30b7ce6c15ae4f63a68123291f0136ee2454bae61fb8ce86d1

SHA512
d456222174d36f0d7e4cebc5929c269f21d9fe10198c7cf36b7b5a63074b80ea05cbe179b13ce07ce20a8a9b6ccadb241afd7e2b02c86c3388dccff622582e88

Download Submit
C:\Users\Admin\AppData\Local\Temp\_l.bat.exe

Filesize
46KB

MD5
c0e667faf8c2ee9f9c5436b316f3f4ef

SHA1
44b75b0de6e5cbe7f3e12bba023ca4322dd9b5ae

SHA256
780d933aaf8e85462837604117dd1e0ea3ee48e5c803937268950e7491f8b5ab

SHA512
26fb36ca8b56a1b41e7cd9e4ba5d5f964ef486786f8d9e430869f47b0852616da442b67cc4ad56bf22fa042c7e26aa5e747f3808c607b1ceadfd70907978a6b1

Download Submit
C:\Windows\SysWOW64\Zombie.exe

Filesize
50KB

MD5
066070957935055a141080ae5de33749

SHA1
e1fab0f38055f91f5a68153875908a77244627cb

SHA256
0459906023ab6664aec86a199cbc70ba6e3425b69553a2279d356328a9a6d655

SHA512
246d6f4c5e3048b4dc7662e67d7c776fcaeccdf9c420b89a9671f21bcea0dff6c57c8668acf21d14cf091d292bb424e79d688c29903bb929fad34dbbe5bb44cf

Download Submit